GitHub Advisoryadvisory · Maven

GHSA-m6cj-93v6-cvr5 Junrar vulnerable to infinite loop via extracting carefully crafted RAR archive

HIGH Published 2022-02-01 Modified 2022-08-11 Official page ↗
Aliases
CVE-2022-23596
Ecosystem
Maven
Packages
com.github.junrar:junrar
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400, CWE-835
Reviewed
2022-01-31

Affected packages

• Maven com.github.junrar:junrar: < 7.4.1 → fixed in 7.4.1

Description

Impact A carefully crafted RAR archive can trigger an infinite loop while extracting said archive. The impact depends solely on how the application uses the library, and whether files can be provided by malignant users. Patches The problem is partially patched in 7.4.1 Workarounds None References https://github.com/junrar/junrar/issues/73 https://github.com/junrar/junrar/issues/81

Related

Alias · CVE (1)

  • CVE-2022-23596 Junrar is an open source java RAR archive library. vulnerability

Weakness · CWE (2)

  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-835 Loop with Unreachable Exit Condition weakness

References